Yet another Hacker News

Lenovo's 'encrypted' fingerprint USB is just an unencrypted SD card in a case

185 points entryleveljobsc 3 hours ago 70 comments

mzajc 2 hours ago | parent

Linked article: https://www.tomshardware.com/tech-industry/cyber-security/le...

reaperducer 2 hours ago | parent

Linked linked article: https://hackingpassion.com/lenovo-thinkplus-encrypted-usb-sd...

lrae 2 hours ago | parent

Linked original talk in linked linked linked article: https://youtu.be/Rv6jdnQ4YhY?t=335

(You actually have to go through https://binary.ninja/2026/10/22/breaking-more-encrypted-usb-... first :))

adrian_b 2 hours ago | parent

One more use of the classic secure password "123456" for a hidden account :-)

forgotpwd16 1 hour ago | parent

This should've been submitted link really. It makes original technical-heavy article more approachable and provides the sources. TH/w offers nothing over it, and neither does the reddit discussion.

matheusmoreira 2 hours ago | parent

Does anyone actually trust these products? Always seemed like a terrible idea to me. The correct solution is to use free software cryptography on top of these things.

alright2565 2 hours ago | parent

I've been required to use similar products due to government regulations. Personally I never trusted them, and I would have loved to take 15 minutes poking around in them, but it was the government who mandated their use for their data so ultimately it was out of my hands.

functionmouse 1 hour ago | parent

That's just the thing; these devices aren't meant to be -good-, they're meant to check boxes.

sllabres 1 hour ago | parent

Was it probably a IronKey? They had a Homeland Security grant, I've used one then. To me software had some advantages. Easy backup of the encrypted data without a dependency to the hardware. IIRC this was somehow solved on the IronKey. Not a black box for the user which have to trust. My main problem with a software solution for me is the entry of the password which I have to do on a probably compromised computer.

The original IronKey (later sold to Kingston) seems to have be cracked. A team / company called Unciphered managed to break a IronKey in a attempt to offer such a decryption to Stefan Thomas who had 7002 bitcoin on this key. This was then worth then 235 million dollar (now >500 million), which is of course a VERY strong motivation. [1]

The Lenovo case of course seems not to be bad implemented security but no security at all, especially if they advertise with encryption, which I found on a Asian Lenovo website where still there are still some specs of the key [2]. A good method if you want to damage your reputation.

[1] https://www.wired.com/story/unciphered-ironkey-password-crac...

[2] https://tk.lenovo.com.cn/product/1003497.html

wildzzz 1 hour ago | parent

I like using the Apricorn keypad flash drives. Like this Lenovo, it's doesn't connect until you unlock it. Password entry is via the built-in keypad so no software is necessary. It's also got a small battery so you can unlock it before you plug it which could prevent someone sniffing the USB 5V rail for any noise. Needing an app makes the Ironkey useless for anything that isn't running a normal desktop OS.

mikeryan 57 minutes ago | parent

Ironically the DOJ isn’t great at this. Infamously they just gave California an encrypted thumb drive with 20,000 names of, allegedly, non-citizens registered to vote.

The password was included on a sticky note in the package.

Waterluvian 2 hours ago | parent

The overwhelming majority of people who use USB sticks for things are likely aware of security and the concept of encryption. But the idea of being able to use “free software cryptography on top” may as well be a trip to Mars.

blooalien 2 hours ago | parent

Most "normies" I know think that open source cryptography is less secure because it's "open" (if they even know open source cryptography is a thing at all). No amount of trying to explain to them how more eyes on the source code generally equals safer encryption will sway most of them in the slightest.

SoftTalker 53 minutes ago | parent

Explain to them that all the commercial products are using the open source code under the covers anyway.

gruez 2 hours ago | parent

>The correct solution is to use free software cryptography on top of these things.

If implemented correctly, "hardware" encryption can be more secure than "free software cryptography". The most obvious benefit is protection against brute-attacks, which you can't meaningfully implement with software. Not to mention added protection of biometric authentication as a second factor, compared to typing a password into a possibly untrusted machine.

close04 1 hour ago | parent

“Correctly” is a big caveat. Almost no HW implementation is auditable in any way.

My baseline assumption is that even the good commercial products are only secure from a non-determined attacker, not TLAs. Anything safe from TLAs is what’s being sold only to them.

gruez 1 hour ago | parent

>Anything safe from TLAs is what’s being sold only to them.

I think you're overestimating how much backdoors there are in products vs actual bugs. As we've seen with with recent vulnerability disclosures, there's plenty of bugs that were put there unintentionally.

close04 1 hour ago | parent

I didn’t make any mention of backdoors or bugs, intentional or accidental, or the prevalence of either. You aren’t wrong but you addressed a point I never made.

The point was that there are special products, implementations of already known algorithms, sold only to TLAs. They have the code validated to the Moon and back, unlike the commercial products.

traverseda 40 minutes ago | parent

We don't know how many of those bugs were intentional, or known, by the three letter agencies.

steelframe 1 hour ago | parent

If you own an Android device, your disk encryption is most likely provided via a UFS/eMMC hardware component known as the "Inline Cryptographic Engine" (ICE). Reputable device manufacturers validate the ciphertext that these devices write out to storage in a test environment by running the plaintext through a software encryption process using the same encryption keys as the OS provides to the ICE. If the ciphertexts match, then it would be unlikely that the hardware encryption engine isn't doing its job right.

close04 51 minutes ago | parent

That’s not validating an implementation. You’re just comparing the output for a few known inputs to known results.

The hardware is still a black box and you’ll never know how it behaves in conditions you didn't test against.

Sopel 1 hour ago | parent

you're not gonna brute force an AES256 key

if you have a bad password that's a user issue

gruez 1 hour ago | parent

You're not gonna remember a AES256 key either (or at least not many of them), not to mention the ergonomics associated with entering a AES256 key. The whole point of security chips like google's titan m2 or apple's secure enclave is to strengthen weak passwords (eg. 6 digit pins) so they offer comparable security to 256 bit keys, without having to enter 256 bit keys.

SV_BubbleTime 44 minutes ago | parent

>You're not gonna remember a AES256 key either

Did we wake up in a world without key derivation functions to turn passwords/phrases into keys?

kalaksi 44 minutes ago | parent

Password isn't used directly as key. The key is derived with PBKDF.

gruez 14 minutes ago | parent

>The key is derived with PBKDF.

Which doesn't do shit even if you're using argon with 32 GB memory usage or whatever. NSA is always going to be able to out-compute you. Not to mention you need a difficulty level that's usable for daily use, but the NSA can brute-force at their leisure, possibly decades in the future.

SV_BubbleTime 40 minutes ago | parent

>you're not gonna brute force an AES256 key

There was a great article around last week about PDFs using randomly generated keys that ended up using non-secure random number generators and the effect was the only unique portion of the key is was 9bits, and obviously forceable. I wouldn’t even describe this between burrito bites activity as “brute”.

The point being “AES” doesn’t mean secure. Secure through the whole implementation means secure. People fuck up crypto all day, calling out a specific cipher doesn’t mean much.

TacticalCoder 1 hour ago | parent

> If implemented correctly, "hardware" encryption can be more secure than "free software cryptography".

Well you can use open-source / free software cryptography to encrypt and decrypt using a secret key which you do not need to remember and which is safely stored behind a secure element.

And there are quite a few people doing just that.

It's immensely more secure than trusting Lenovo or Microsoft or whatever company.

And you can have your secret on the secure element protected by biometric auth too (some do offer just that).

And there are devices like that with a tiny attack surface that accept biometric (like your fingerprint) to unlock the secret.

To get the best of both world you trust the HSM with one thing: the secret, and that's it. And you use open-source software and protocols (like GPG and OpenSSH) with that secret.

swinglock 2 hours ago | parent

There's a guy with some Bitcoin that knows about a model, I'd trust that one.

jonathanstrange 1 hour ago | parent

Software is insecure in many scenarios because endpoint security is abysmal. Of course, a USB stick with fingerprint reader cannot be secure but there is no way around hardware-based cryptography with independent key entry if you need real security. Then again, this won't help you if the secrets are transferred to the insecure endpoint anyway.

bluedino 1 hour ago | parent

We have to use the ones that cost 8x more than regular ones and are certified by something that our industry approves.

lokar 1 hour ago | parent

The ironkey at least has reasonable independent evaluations.

OptionOfT 5 minutes ago | parent

We used these: https://apricorn.com/aegis-padlock-usb3

They work well in high security environments because you can allowlist the vendor and product id of only these hard drives, and you don't have to set up procedures where people HAVE to encrypt their drives before use.

So cost-wise it makes sense.

But for personal use? BitLocker / VeraCrypt all the way.

nik282000 2 hours ago | parent

Marketing wank made to sell e-waste to middle management.

ctkhn 2 hours ago | parent

Didn't expect something this crazy but I will not trust stuff like this until I've seen a teardown. Imagine being the product manager who approved this shit

pjmlp 2 hours ago | parent

As things are, they probably don't even know there is a website called hacker news.

jagged-chisel 2 hours ago | parent

Why a link to Reddit instead of the link to Tom’s Hardware?

Mashimo 1 hour ago | parent

It goes even deeper. On Toms Hardware you find a link to a blog that is based on a talk.

dpacmittal 2 hours ago | parent

Just use veracrypt or ecrypt on any memory card. These devices don't deserve the premium they charge for on-device encryption which in this case is not even encyrypted

judge2020 2 hours ago | parent

Were semicolons in subheadings common before AI? This subheading of the TomsHardware article just seems very artificial:

> The fingerprint only switched the USB connection on; nothing on the card was encrypted.

swinglock 2 hours ago | parent

Not long ago it would have been an em dash.

Loughla 1 hour ago | parent

I mean, it's a terrible subheading because it's way too long, but it's grammatically correct. It doesn't read like AI to me, why do you think it is?

pdpi 1 hour ago | parent

The issue with AI-produced text is rarely bad grammar these days (if anything, that's a marker of human-written text now!), but rather stiff-sounding constructions that humans don't actually use. In this case — semicolons are grammatically correct, but very few people actually use them them (same for em-dashes like what I just used, but you can pry them from my cold, dead fingers).

robertoandred 34 minutes ago | parent

I’d expect people writing for a living to understand and use semicolons.

solyin 1 hour ago | parent

Oh god dammit, I have to stop using semicolons now? That's stupid.

judge2020 1 hour ago | parent

Less semicolons overall, more the "statement; reveal/impact" formula that current frontier models like.

weego 1 hour ago | parent

They were if you read a news source that catered to literate readers.

mytailorisrich 2 hours ago | parent

Well it's called FU after all...

untessela 2 hours ago | parent

Can anyone find a product listing where this was actually for sale? I couldn't.

vbezhenar 2 hours ago | parent

https://aliexpress.ru/item/1_963163498.html

rendaw 1 hour ago | parent

Do you mean that it's only sold by the Russian branch of the unvalidated Chinese marketplace?

rendaw 1 hour ago | parent

Yeah, searching I only got Chinese pages and copies of this article itself. Tried searching directly too. I have a hard time they pulled it of shelves so fast that the internet already erased it... I'd expect at least "out of stock" pages to remain.

And the article doesn't even have an image of the product as sold.

forgotpwd16 1 hour ago | parent

https://www.thinkpad.com/device/458

Thought was fake branded product at first and just no one bothered to check, but apparently is available in Lenovo CN's store.

l0new0lf-G 2 hours ago | parent

How much hardware and even software that is supposedly used for encryption is actually backdoored?

We know that Microsoft's bitlocker had at least one backdoor. Lenovo's fingerprint USB also has backdoors.

It seems like only open source solutions actually provide encryption, like LUKS and Veracrypt. Then again, who guarantees that the executables are actually build from the source? Or that the keys aren't somehow sent over to agencies by the operating system?

TLDR, we cannot realistically trust anything in this dictatorship of mass surveillance.

gruez 1 hour ago | parent

>We know that Microsoft's bitlocker had at least one backdoor

Source? The closest I found was microsoft's key escrow system, but that's hardly a "backdoor" given it's publicly documented, and it's explicitly stated in no uncertain terms when you're setting it up[1]

[1] https://static0.howtogeekimages.com/wordpress/wp-content/upl...

vel0city 1 hour ago | parent

Look up YellowKey. Specifically crafted NTFS transaction logs would unlock any Bitlocker drive with transparent encryption. Some people believe it was an intentional backdoor, kind of a debated topic.

I'm not 100% certain either way.

gruez 1 hour ago | parent

>any Bitlocker drive with transparent encryption

Which even microsoft admits is basically a LARP from a security point of view. It's better than nothing, but it's not meant to stand up against serious attacks. Even without the yellowkey exploit, it can be bypassed via interposer attacks on the TPM.

https://learn.microsoft.com/en-us/windows/security/operating...

aliasxneo 1 hour ago | parent

I can imagine some "Hollywood hacker" scene where the guy steals an encrypted USB and proceeds to break into it.

"How did you get the data?"

"It was just an unencrypted SD card inside"

Not very exciting, but I guess just as accurate as reality!

RobotToaster 1 hour ago | parent

This could've been rendered relatively secure had the USB stick been potted, but I guess that would've cost an extra few cents. https://en.wikipedia.org/wiki/Potting_(electronics)

blurbleblurble 1 hour ago | parent

Too expensive at scale

icpmoles 41 minutes ago | parent

It was potted (page 19 of the slides https://github.com/xusheng6/breaking_encrypted_USB_drives_wi... )

charles_f 34 minutes ago | parent

> an interim fix using epoxy over the card

It was

Retr0id 1 hour ago | parent

This should be illegal. And maybe it already is? What consequences will Lenovo face, if any?

nik282000 28 minutes ago | parent

None, they will just claim that opening the device voids the security features.

aftbit 1 hour ago | parent

Why would they do it this way? If they're going to add a custom controller on the outside, why not make it encrypt before writing to the SD card?

forgotpwd16 49 minutes ago | parent

Because incompetence.

forgotpwd16 53 minutes ago | parent

Interesting those those news are quite late, probably because it (and the entire ThinkPlus USB lineup) wasn't available outside CN. The product was first announced 2019, the flaw was found Aug 2025, CVE-2025-13453 was issued early Jan, and Li's presentation was in Mar.

jqpabc123 46 minutes ago | parent

Just buy a standard USB drive and encrypt it with Bitlocker. If you hate MS then use Veracrypt.

What am I missing here?

charles_f 28 minutes ago | parent

I'm not sure what codex helped with for the Lenovo case, if all that was required was open the stick and stick the sdcard into a computer.

It's crazy that Lenovo will still be trusted to build secured hardware after that. It's not even a vulnerability at this point, I'm not sure how this could pass any form of security review, let alone having anyone review the design and approve it. They must have known it was nothing they pretended and still decide to sell it.

hosteur 6 minutes ago | parent

So basically fraud? I’m sure the responsible people are getting fired and fined/jailed.